I'm using a forwarder (regular) to forward TCP input to indexer. The events are being forwarded correctly to the indexer, but for some reason its assigning sourcetype=tcp-raw even though i've specified props and transforms on the indexer. here's my configs :
on forwarder : inputs.conf
[tcp://9996] disabled = false connection_host = ip
on forwarder : outputs.conf
[tcpout] defaultGroup=my_indexer compressed=false indexAndForward=false [tcpout:my_indexer] compressed=false server=192.168.77.1:9997
on indexer where props and transforms is occuring : props.conf
[source::tcp:9996] TRANSFORMS-sourcetyping_testlog = test_log TRANSFORMS-indexrouting_testlog = testlog_index
and my transforms.conf
[test_log] DEST_KEY = MetaData:Sourcetype REGEX = solaris-new FORMAT = sourcetype::test_newlog [testlog_index] DEST_KEY = _MetaData:Index REGEX = solaris-new FORMAT = testlog
i didnt want to set sourcetype on forwarder itself using inputs.conf or props/transforms as i wanted to perform all transformations on the indexer. The events are coming thro correctly to the indexer but sourcetype=tcp-raw is being assigned.
can i get some help on this ?
in props.conf you could have
and that should work
I could have done that, but can't since i'll have events coming in from different devices on the same tcp port which needs different sourcetypes to be set according to regex. so i'll need a transforms.conf to set sourcetype.
curious to know from where tcp-raw sourcetype is being set.